user opassord are now stored as hashes